Gravar-mail: What can we learn from a decade of database audits? The Duke Clinical Research Institute experience, 1997–2006